How Bastion works
From the first attack to a fix that holds, only inside the limits you set
01
From first attack to merged fix
Every step, in the tools you already use
Install Bastion
on your organization acme
Repository access
Bastion will be able to
- Read code and metadata
- Read and write pull requests
- Read and write checks
Integrate with your environment
02
Fix at the root
Every fix comes from an attack that landed, so you can merge it without triage.
Add the GitHub app
The pentest lands an attack
Orders marked paid without a real payment
Confirmed by sending a payment notice with the signature removed
The fix opens from that result
Verify payment notifications
Opened by Bastion from the pentest result
03
Then we attack again
POST /payments/notify
order: 1042
status: paid
signature: a1f9…
POST /payments/notify
order: 1042
status: paid
signature: (none)
POST /payments/notify
order: 1042
status: paid
signature: (none)
- signature: ""401
- signature: null401
- signature: %00401
- signature: =401
- signature ×2401
04·CVE-2026-61663 found, disclosed and fixed upstream·more write-ups
06
What never changes
You set the scope
Domains, endpoints and agents, verified as yours. Nothing outside it is touched
Our own test accounts
Seeded with synthetic secrets. Your users' accounts and data are never accessed
Nothing deleted
Access is proven, never used to remove anything
Unproven stays unproven
A step we can't show safely is marked unverified, not asserted
